Analysis
- max time kernel
149s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
26/10/2026, 13:44
General
- Target 2026-10-25_bff31c8c90efcc9bdf4e54332fc3a92d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261026-q1ssbas15j
- SHA256 b75282395ec61bfedbf0005277f8d4cbd17c08caf07e941b9a5034b6e584d3ea
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-25_bff31c8c90efcc9bdf4e54332fc3a92d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-25_bff31c8c90efcc9bdf4e54332fc3a92d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\pnhfaxsqkhcauspn.exeC:\Temp\pnhfaxsqkhcauspn.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\axvpnhfzxs.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\axvpnhfzxs.exeC:\Temp\axvpnhfzxs.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_axvpnhfzxs.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_axvpnhfzxs.exeC:\Temp\i_axvpnhfzxs.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cxupmkhfzx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\cxupmkhfzx.exeC:\Temp\cxupmkhfzx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cxupmkhfzx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_cxupmkhfzx.exeC:\Temp\i_cxupmkhfzx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zwupjhczxr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zwupjhczxr.exeC:\Temp\zwupjhczxr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zwupjhczxr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zwupjhczxr.exeC:\Temp\i_zwupjhczxr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\heywuomjhb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\heywuomjhb.exeC:\Temp\heywuomjhb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_heywuomjhb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_heywuomjhb.exeC:\Temp\i_heywuomjhb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wtrmjdbwto.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wtrmjdbwto.exeC:\Temp\wtrmjdbwto.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wtrmjdbwto.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wtrmjdbwto.exeC:\Temp\i_wtrmjdbwto.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qoigdyvtql.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qoigdyvtql.exeC:\Temp\qoigdyvtql.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qoigdyvtql.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qoigdyvtql.exeC:\Temp\i_qoigdyvtql.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\olfdyvtnlj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\olfdyvtnlj.exeC:\Temp\olfdyvtnlj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_olfdyvtnlj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_olfdyvtnlj.exeC:\Temp\i_olfdyvtnlj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kidavtnkic.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kidavtnkic.exeC:\Temp\kidavtnkic.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kidavtnkic.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kidavtnkic.exeC:\Temp\i_kidavtnkic.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\faxsqkicav.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\faxsqkicav.exeC:\Temp\faxsqkicav.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_faxsqkicav.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_faxsqkicav.exeC:\Temp\i_faxsqkicav.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\upnhfzxrpk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\upnhfzxrpk.exeC:\Temp\upnhfzxrpk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_upnhfzxrpk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_upnhfzxrpk.exeC:\Temp\i_upnhfzxrpk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxrpmhecau.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zxrpmhecau.exeC:\Temp\zxrpmhecau.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxrpmhecau.exe ups_ins3⤵
-
C:\Temp\i_zxrpmhecau.exeC:\Temp\i_zxrpmhecau.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pmhezxrpjh.exe ups_run3⤵
-
C:\Temp\pmhezxrpjh.exeC:\Temp\pmhezxrpjh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pmhezxrpjh.exe ups_ins3⤵
-
C:\Temp\i_pmhezxrpjh.exeC:\Temp\i_pmhezxrpjh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rljebwtolj.exe ups_run3⤵
-
C:\Temp\rljebwtolj.exeC:\Temp\rljebwtolj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rljebwtolj.exe ups_ins3⤵
-
C:\Temp\i_rljebwtolj.exeC:\Temp\i_rljebwtolj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\olgeywqoiy.exe ups_run3⤵
-
C:\Temp\olgeywqoiy.exeC:\Temp\olgeywqoiy.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_olgeywqoiy.exe ups_ins3⤵
-
C:\Temp\i_olgeywqoiy.exeC:\Temp\i_olgeywqoiy.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gdbvtnlgdb.exe ups_run3⤵
-
C:\Temp\gdbvtnlgdb.exeC:\Temp\gdbvtnlgdb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gdbvtnlgdb.exe ups_ins3⤵
-
C:\Temp\i_gdbvtnlgdb.exeC:\Temp\i_gdbvtnlgdb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqoigdxvqn.exe ups_run3⤵
-
C:\Temp\sqoigdxvqn.exeC:\Temp\sqoigdxvqn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sqoigdxvqn.exe ups_ins3⤵
-
C:\Temp\i_sqoigdxvqn.exeC:\Temp\i_sqoigdxvqn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hfaxsqkica.exe ups_run3⤵
-
C:\Temp\hfaxsqkica.exeC:\Temp\hfaxsqkica.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hfaxsqkica.exe ups_ins3⤵
-
C:\Temp\i_hfaxsqkica.exeC:\Temp\i_hfaxsqkica.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nifcauspnh.exe ups_run3⤵
-
C:\Temp\nifcauspnh.exeC:\Temp\nifcauspnh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nifcauspnh.exe ups_ins3⤵
-
C:\Temp\i_nifcauspnh.exeC:\Temp\i_nifcauspnh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kecxupnhfz.exe ups_run3⤵
-
C:\Temp\kecxupnhfz.exeC:\Temp\kecxupnhfz.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kecxupnhfz.exe ups_ins3⤵
-
C:\Temp\i_kecxupnhfz.exeC:\Temp\i_kecxupnhfz.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cwupmhezxr.exe ups_run3⤵
-
C:\Temp\cwupmhezxr.exeC:\Temp\cwupmhezxr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x31c,0x7fffbc32c188,0x7fffbc32c194,0x7fffbc32c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2136,i,15522734840873202607,10196274824307007147,524288 --field-trial-handle=2472,i,13864527051533709574,4008133844043521612,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1972,i,175590296076166002,11755426677630805786,262144 --field-trial-handle=2472,i,13864527051533709574,4008133844043521612,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2348,i,14507768772826091096,14654882179648270445,524288 --field-trial-handle=2472,i,13864527051533709574,4008133844043521612,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,8509132220497351855,14879153008712090346,2097152 --field-trial-handle=2472,i,13864527051533709574,4008133844043521612,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,9312155770141240964,6055925776935704088,2097152 --field-trial-handle=2472,i,13864527051533709574,4008133844043521612,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,1686967345654367764,10873360940997675950,2097152 --field-trial-handle=2472,i,13864527051533709574,4008133844043521612,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,1868359877969787847,11924674975283428579,2097152 --field-trial-handle=2472,i,13864527051533709574,4008133844043521612,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,14968900683237529995,10200879804609181453,524288 --field-trial-handle=2472,i,13864527051533709574,4008133844043521612,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5076,i,15558168674412127004,13786572611297922624,2097152 --field-trial-handle=2472,i,13864527051533709574,4008133844043521612,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3848,i,6636735677351241788,607777692014396222,2097152 --field-trial-handle=2472,i,13864527051533709574,4008133844043521612,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,16037273860475838233,2419101539213654457,524288 --field-trial-handle=2472,i,13864527051533709574,4008133844043521612,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,2698791244634386283,2667857253738130759,524288 --field-trial-handle=2472,i,13864527051533709574,4008133844043521612,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2132,i,1402569406650642228,14113425632968893534,524288 --field-trial-handle=2472,i,13864527051533709574,4008133844043521612,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2132,i,1402569406650642228,14113425632968893534,524288 --field-trial-handle=2472,i,13864527051533709574,4008133844043521612,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,5340303689478686256,9787030977882897414,524288 --field-trial-handle=2472,i,13864527051533709574,4008133844043521612,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,11310558283670392938,14238895435937906098,524288 --field-trial-handle=2472,i,13864527051533709574,4008133844043521612,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,17194776306294957622,3838102970002120868,524288 --field-trial-handle=2472,i,13864527051533709574,4008133844043521612,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,911103064349864549,10888074727136182868,524288 --field-trial-handle=2472,i,13864527051533709574,4008133844043521612,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4680,i,15681453080078783937,15767288137192052089,524288 --field-trial-handle=2472,i,13864527051533709574,4008133844043521612,262144 --variations-seed-version --mojo-platform-channel-handle=1276 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4624,i,5913229709965610299,3814760798911393809,524288 --field-trial-handle=2472,i,13864527051533709574,4008133844043521612,262144 --variations-seed-version --mojo-platform-channel-handle=1268 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,7232647433134449699,8629445173625698268,524288 --field-trial-handle=2472,i,13864527051533709574,4008133844043521612,262144 --variations-seed-version --mojo-platform-channel-handle=1964 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,1224635906214349018,6847691346763098576,524288 --field-trial-handle=2472,i,13864527051533709574,4008133844043521612,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6804,i,2188253804182173294,13370254084939537422,524288 --field-trial-handle=2472,i,13864527051533709574,4008133844043521612,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,848478171977742498,2717602967803377252,524288 --field-trial-handle=2472,i,13864527051533709574,4008133844043521612,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,7632942320792161201,6082031095204851531,524288 --field-trial-handle=2472,i,13864527051533709574,4008133844043521612,262144 --variations-seed-version --mojo-platform-channel-handle=1964 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6052,i,17185790929164675004,5528371240045955628,262144 --field-trial-handle=2472,i,13864527051533709574,4008133844043521612,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,1503063368512672931,5236408814273694861,524288 --field-trial-handle=2472,i,13864527051533709574,4008133844043521612,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\pnhfaxsqkhcauspn.sysC:\Temp\pnhfaxsqkhcauspn.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\vsmkfcxspn.sysC:\Temp\vsmkfcxspn.sys1⤵
- Executes dropped EXE
-
C:\Temp\ecwuomkecw.sysC:\Temp\ecwuomkecw.sys1⤵
- Executes dropped EXE
-
C:\Temp\ecwtrpjhbz.sysC:\Temp\ecwtrpjhbz.sys1⤵
- Executes dropped EXE
-
C:\Temp\eywqojgbyt.sysC:\Temp\eywqojgbyt.sys1⤵
- Executes dropped EXE
-
C:\Temp\bytrljdbwt.sysC:\Temp\bytrljdbwt.sys1⤵
- Executes dropped EXE
-
C:\Temp\vtqljdbvtn.sysC:\Temp\vtqljdbvtn.sys1⤵
- Executes dropped EXE
-
C:\Temp\nifaysqkic.sysC:\Temp\nifaysqkic.sys1⤵
- Executes dropped EXE
-
C:\Temp\fcayspnkic.sysC:\Temp\fcayspnkic.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfaxsqkica.sysC:\Temp\hfaxsqkica.sys1⤵
- Executes dropped EXE
-
C:\Temp\zxrpjhfzxu.sysC:\Temp\zxrpjhfzxu.sys1⤵
- Executes dropped EXE
-
C:\Temp\mjebzurmke.sysC:\Temp\mjebzurmke.sys1⤵
-
C:\Temp\wuomhezwug.sysC:\Temp\wuomhezwug.sys1⤵
-
C:\Temp\tromgeywro.sysC:\Temp\tromgeywro.sys1⤵
-
C:\Temp\lgeywqoigb.sysC:\Temp\lgeywqoigb.sys1⤵
-
C:\Temp\xvqnlfdbvt.sysC:\Temp\xvqnlfdbvt.sys1⤵
-
C:\Temp\dxvpnifays.sysC:\Temp\dxvpnifays.sys1⤵
-
C:\Temp\kifaxvpnki.sysC:\Temp\kifaxvpnki.sys1⤵
-
C:\Temp\mkhfzxspkh.sysC:\Temp\mkhfzxspkh.sys1⤵
-
C:\Temp\czxrpjhbzw.sysC:\Temp\czxrpjhbzw.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
axvpnhfzxs.exe
bytrljdbwt.sys
cxupmkhfzx.exe
ecwtrpjhbz.sys
ecwuomkecw.sys
eywqojgbyt.sys
heywuomjhb.exe
i_axvpnhfzxs.exe
i_cxupmkhfzx.exe
i_heywuomjhb.exe
i_wtrmjdbwto.exe
i_zwupjhczxr.exe
pnhfaxsqkhcauspn.exe
pnhfaxsqkhcauspn.sys
vsmkfcxspn.sys
wtrmjdbwto.exe
zwupjhczxr.exe
119bfd47-270f-4c94-99fd-e74d2ba3e4ef.tmp
511f2bac-0b81-4f39-b688-ca68cde49e23.tmp
settings.dat
settings.dat
033fe11d-9d0f-4807-ac5e-1ff0e38f0717.tmp
19bd3961-ad9c-4e77-985b-beef937ad992.tmp
32b24869-94e1-443a-bdf4-9688364c10f0.tmp
453d7610-03a0-49ca-8eac-f110a66f50f4.tmp
598ab542-245b-4287-8190-6310c7d7f5e7.tmp
temp-index
the-real-index
eb989abf-0e4c-48cd-b464-ba90350c154d.tmp
07fa3714-4486-4108-96d3-ff00e17675c9.tmp
3a84da21-6866-41fc-a1ef-e89827312425.tmp
44d38986-bfdb-4ee4-8d3f-c627b9363558.tmp
42121fa6-d9b0-48a2-901b-6dfb3a8d0909.tmp
OperationConfig
a75e7411-9078-4d3a-b343-2663cbcefcf5.tmp
b82227b6-3614-40f7-b40f-7600c6383cf2.tmp
a3021c63-81b8-4ecf-a5e3-4a89644de257.tmp
db3dfd72-3b8e-4786-ac6a-6a6a546e7d6c.tmp
fe21d470-5481-4f91-aa46-d168613751ca.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
5d31b952-12c2-4ccb-aad9-58e3dd81bbcc.tmp
7b4e1a01-2e6e-4900-b73d-8eafdf660bc8.tmp
fb93b33b-0126-4d6c-a21c-58bc3b10e363.tmp
a5f56c21-723a-4320-9b76-7d6db6c4057d.tmp
c25eb7f3-af1d-45e4-b0cb-9260903bd700.tmp
messages.json
messages.json
dasherSettingSchema.json
service_worker_bin_prod.js
content.js
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/1240-865-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2088-848-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2656-782-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2712-890-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2752-728-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2820-886-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2904-653-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2968-908-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3012-707-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3296-748-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3564-693-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4124-694-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4124-681-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4128-732-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4136-604-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4260-72-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4300-794-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4572-752-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5320-824-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5748-828-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5876-860-0x0000000000010000-0x00000000000AB000-memory.dmp